Attack Chain

This brief describes a detection capability for anomalous behavior rather than a specific observed attack chain. The underlying threat involves an adversary who has gained access to a legitimate user account and then attempts to escalate privileges by executing unusual or unauthorized privileged commands.

Impact

Failure to detect and respond to unusual privileged command execution by a user on Linux systems can lead to successful privilege escalation by an attacker. This can grant an adversary higher-level access to critical system functions, sensitive data, and network resources. The impact could range from unauthorized data exfiltration, system compromise, persistent backdoor installation, to complete control over the affected system and lateral movement within the network. Such incidents can result in significant financial losses, reputational damage, and regulatory penalties.

Recommendation

• Deploy the Elastic Privileged Access Detection integration and enable the Unusual Process Detected for Privileged Commands by a User machine learning job to detect anomalous privileged command execution.
• Ensure Linux logs are collected by Elastic Defend or Sysmon Linux integrations, as these are prerequisites for the Privileged Access Detection rule.
• Review specific user accounts associated with alerts from the Unusual Process Detected for Privileged Commands by a User rule to determine if the activity is legitimate or anomalous.
• Examine process details, including command line arguments and parent processes, collected from Elastic Defend or Sysmon Linux when an alert is triggered, to identify potentially malicious binaries.
• Isolate affected user accounts immediately and terminate suspicious processes or sessions as part of the remediation steps when alerts generated by this rule indicate malicious activity.
• Conduct thorough audits of recent privileged commands executed by an alerted user to identify any unauthorized changes or actions that need to be reversed.

Attack Chain

1. An attacker establishes initial access to a target system using various methods (e.g., phishing, exploiting a vulnerability).
2. The attacker deploys or repurposes a benign-looking process on the compromised system.
3. Sensitive data is identified and staged for exfiltration on the local system.
4. The attacker leverages the seemingly legitimate process to write the staged sensitive data to an external device (e.g., USB drive, network share mapped as an external drive).
5. The external device is removed, or the connection is terminated, completing the exfiltration of sensitive information.
6. The unusual behavior of this rare process writing to an external device triggers an anomaly detection by Elastic's ML rule.

Impact

Successful data exfiltration can lead to severe consequences, including intellectual property theft, compromise of sensitive customer or employee data, regulatory fines due to data breaches, reputational damage, and financial losses. The targeted sectors are broad, as any organization handling valuable data is at risk. While the detection rule identifies a specific activity rather than a campaign, the impact of such exfiltration could range from minor data loss to a catastrophic breach depending on the volume and sensitivity of the data involved.

Recommendation

• Deploy the Data Exfiltration Detection integration and configure the machine learning job ded_rare_process_writing_to_external_device_ea to leverage Elastic's anomaly detection capabilities.
• Ensure Elastic Defend is fully installed and collecting file events on all endpoints, as indicated in the setup instructions.
• When an alert is triggered, investigate the process name, path, and associated user account to determine if the activity is legitimate, as suggested in the investigation guide.
• Review the external device's details and the volume and type of data being written to identify any sensitive or unusual transfers.
• Use the provided "Investigation Guide" within the rule's note to systematically triage and analyze alerts generated by this rule.
• Create allowlists for legitimate backup processes, data transfer applications, software updates, and IT maintenance activities to reduce false positives, as mentioned in the "False positive analysis" section.